diff --git a/.gitea/workflows/build-next.yml b/.gitea/workflows/build-next.yml
index bac982d..5f16993 100644
--- a/.gitea/workflows/build-next.yml
+++ b/.gitea/workflows/build-next.yml
@@ -119,9 +119,14 @@ jobs:
       # failure only warns: the image is pushed and the midnight
       # podman-update.timer deploys it anyway.
       - name: Trigger immediate deploy
+        # The key comes in through env, not ${{ secrets.* }} in the script:
+        # the runner prints the script, and Gitea does not mask a multi-line
+        # secret once it is split across script lines.
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
         run: |
           install -m600 /dev/null "$HOME/.deploy_key"
-          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > "$HOME/.deploy_key"
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.deploy_key"
           ssh -i "$HOME/.deploy_key" \
               -o BatchMode=yes \
               -o StrictHostKeyChecking=accept-new \